Toll fraud. It costs companies billions of dollars every year. From the perpetrators' view, toll fraud is enormously profitable and low risk. Unless the offender is careless, the chance of being caught is negligible.  If they are somehow apprehended, chances are they will not be successfully prosecuted. If convicted, chances are the time they will serve, if any, will be minimal.

One of the best ways to help protect yourself or your company from toll fraud is to learn how hackers gain access to your systems so you can block their entry.  These perpetrators can use several methods of hacking a PBX or gaining access to your Voice over IP webportal.  Here are just a few examples.

Note: This information is not designed to provide an audit program of all risks and features.

How Do They Do It?  One of the most popular methods is voice mail hacking.  If a mailbox password is guessable and the system is not tightly programmed, a hacker might be able to reprogram the background data-base and operator number to obtain international access to use when they want it, just by dialing "0".  Transferring out of the mailbox means that the number can be re-used over and over until all the company's lines are in use.  Some Voice Mail Systems allow an incoming call to access an outbound line through the PBX using a feature sometimes known as "thru-dial". When a hacker breaks the simple password to a mailbox they can use this feature to get an outbound dial tone. Also by using the call transfer feature of the Voice Mail System, the hacker may get dial tone by entering the transfer code and the first digits of the number to be called. An example would be *T91XX where T is the digit your system has assigned for transfer, XX is the first two digits and XX is the first two digits of the called number.  Stop hackers at the first stage by having secure mailbox passwords.  Change them regularly and delete unused mailboxes.  Commencing right from the new installation, never allow default mailbox and administrator passwords to be retained in your system.

Direct Inward System Access (DISA) is designed to connect external dialers as if they are inside the company's PBX.  DISA is usually used for after-hours, international calls that can be made from home rather than staying back in the office.  Password mechanisms for DISA allow secure operation but leaving them off exposes the company to toll fraud by hackers who discover or know of the DISA dial in numbers(s).  Hackers gaining access to your system's programming core can also set up a password free DISA number without you knowing it.  If you don't need it, have DISA removed from your PBX.  If DISA is needed, monitor it closely and change passwords often.

Another method is maintenance port hacking.  Logins and passwords on maintenance modem and the PBX will restrict remote access to only authorized parties.  However, leaving these off or set to well-known default values will leave the way open for hackers anywhere in the world to remotely access and reconfigure the PBX, modify security and dialing parameters, design and plan to dial in and out of your system and return when you aren't suspecting anything out of the ordinary.  The toll fraud perpetrators are experienced in the technology of all PBX and voice mail systems on the market.

With regard to Voice over IP, weak user passwords on webportals can be compromised. When the telephone number is known, hackers may gain access by utilizing the weblink for the portal and by guessing the password. Once inside the webportal, hackers set up meet me conference calls or three way calls. In addition, weak voice mail passwords are at risk in a similar way to PBXs.  Although the dial thru feature is not available with Harbor's VoIP product, a voice mail box can be compromised and the "0" out number can then be set to dial any designated destination.  After the "0" out number is set, the hacker simply calls the voice mail box and when the greeting starts, "0" is pressed and the call connects.

What Else Should You Do?  PBX systems can restrict calls by numbers, time of day, country codes, etc.  You must decide what suits your business and what procedures need to be in place to keep the system secure.

Call your installer or systems vendor and jointly review what numbers are allowed and barred in your PBX and your voice mail. Adopt a philosophy of initially barring all outside calls and only opening up to places that are requested or approved. This approach allows all the new services being added by carriers to be automatically excluded until they are specifically allowed.